bacon/rss-proxy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Configure SAST in .gitlab-ci.yml, creating this file if it does not already exist

Browse Source
This commit is contained in:
Slava
2025-03-05 22:17:01 +00:00
parent 09528e0c3c
commit 47019ab5c3
1 changed files with 58 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
.gitlab-ci.yml
View File

@@ -1,3 +1,10 @@
# You can override the included template(s) by including variable overrides
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/pipeline/#customization
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
# Note that environment variables can be set in several places
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
workflow: workflow:
rules: rules:
- changes: - changes:
@@ -6,31 +13,29 @@ workflow:
- requirements.txt - requirements.txt
when: always when: always
- when: never - when: never
stages: stages:
# - test
- build - build
- pre_push - pre_push
- push - push
- test
# test: - deploy
# stage: test - review
# image: python:3.11-alpine - dast
# script: - staging
# - pip install -q -r requirements.txt - canary
# - pip install -q pytest~=8.3.5 - production
# - python -m unittest discover tests - incremental rollout 10%
- incremental rollout 25%
- incremental rollout 50%
- incremental rollout 100%
- performance
- cleanup
build: build:
# needs:
# - test
stage: build stage: build
script: script:
- docker build -t $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG . - docker build -t $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG .
- docker tag $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_SHORT_SHA - docker tag $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_SHORT_SHA
- docker tag $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG $CI_REGISTRY/$CI_PROJECT_PATH:latest - docker tag $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG $CI_REGISTRY/$CI_PROJECT_PATH:latest
pre_push: pre_push:
needs: needs:
- build - build
@@ -40,7 +45,8 @@ pre_push:
script: script:
- echo "Running container to test image" - echo "Running container to test image"
- docker run -d --rm --name test_container $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG - docker run -d --rm --name test_container $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG
- CONTAINER_IP=$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' test_container) - CONTAINER_IP=$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}'
test_container)
- | - |
echo "Waiting for the application to start..." echo "Waiting for the application to start..."
sleep 10 sleep 10
@@ -50,17 +56,19 @@ pre_push:
echo "Healthcheck failed, stopping push" echo "Healthcheck failed, stopping push"
exit 1 exit 1
fi fi
after_script: after_script:
- docker rm -f test_container - docker rm -f test_container
push: push:
needs: needs:
- pre_push - pre_push
stage: push stage: push
script: script:
- echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin $CI_REGISTRY - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin
$CI_REGISTRY
- docker push $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_SHORT_SHA - docker push $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_SHORT_SHA
- docker push $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG - docker push $CI_REGISTRY/$CI_PROJECT_PATH:$CI_COMMIT_REF_SLUG
- docker push $CI_REGISTRY/$CI_PROJECT_PATH:latest - docker push $CI_REGISTRY/$CI_PROJECT_PATH:latest
sast:
stage: test
include:
- template: Auto-DevOps.gitlab-ci.yml